Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrect nonce validation on the funp_ajax_modify_notes function. This makes it possible for unauthenticated attackers to trick a logged-in user into visiting a malicious page, causing unauthorized overwriting of that victim's own note content via a forged cross-site request to wp_update_post() via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Due to ownership enforcement comparing the note's stored _funp_single_user_id meta against the current session's user ID, the attack is limited to modifying only notes belonging to the tricked victim, and cannot be used to alter notes owned by arbitrary third-party users.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-07 | 2 | Disclosure2 |
| 2026-06-13 | 1 | PoC1 |
CVE-2026-7047 The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrec… https://www.cve.org/CVERecord?id=CVE-2026-7047
Post summary
The post announces that CVE-2026‑7047 affects the Frontend User Notes WordPress plugin with a CSRF flaw in all versions up to 2.1.1, but offers no additional exploit, patch, or mitigation details.
https://atomicedge.io/cve-proof/cve-2026-7047-frontend-user-notes-version-2-1-1-medium-vulnerability-proof-of-concept CVE-2026-7047 frontend-user-notes (CVSS Score 4.3) #WordPress plugin #vulnerability #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #…
Post summary
The post shares a proof‑of‑concept for CVE‑2026‑7047 affecting the Frontend‑User‑Notes WordPress plugin, stating a CVSS score of 4.3, but offers no evidence of active exploitation or available patch.
🚨*CVE* CVE-2026-7047 The Frontend User Notes plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.1. This is due to missing or incorrec… https://www.cve.org/CVERecord?id=CVE-2026-7047 ----- Traducción: CVE-2026-7047 El … http://infoflow.cloud`
Post summary
Post announces a CSRF flaw in Frontend User Notes WordPress plugin up to version 2.1.1, with no PoC, exploit, or patch details.